1. Data controller
[RAZÓN SOCIAL], with Tax ID [RFC] and domiciled at [DOMICILIO] ("SpotLocator", "we"), is responsible for processing your personal data under the LFPDPPP in force.
Privacy contact: [correo de privacidad].
2. Personal data we collect
2.1 Registration and account: full name, email, password (hashed with Argon2id; never in plain text), business name (optional) and country.
2.2 Technical and security data: IP address and user agent (logged at sign-in and when accepting legal documents, for security and fraud prevention), device identifier, and activity logs with date, time and IP.
2.3 Payment data: we do not store card data; Stripe processes it and it goes directly to Stripe. We keep only the operation/subscription identifier, the plan or pack purchased and the payment status. Your email is shared with Stripe to process the charge and, where applicable, your receipt.
2.4 Content you create: maps, spots, drawings, groups, with names, addresses, coordinates, descriptions, tags, notes and images. If you include third-party data, you are responsible for having the right to process and publish it, and we act as processor.
2.5 AI assistant: when you use Spoty, your prompts and the necessary map context are processed to generate the response and kept in your history. This involves automated decisions assisted by AI models (see sections 4 and 6).
3. Purposes of processing
Under the LFPDPPP in force, we distinguish necessary purposes (without which we cannot provide the Service) from voluntary ones (which you may object to without affecting the Service).
Necessary purposes:
- Create, manage and authenticate your account.
- Provide the Service: create and publish maps, spots and drawings; run the AI assistant; measure and charge credit usage.
- Process payments and issue tax receipts.
- Security, fraud prevention and legal compliance.
Voluntary purposes (you may object by writing to [correo de privacidad]):
- Product improvement and aggregate usage analytics.
- Communications about news and promotions, if you enable them.
4. Processors and transfers (third parties)
To provide the Service, certain data is handled by providers acting as processors, processing it only under our instructions:
| Provider | Data handled | Purpose |
|---|---|---|
| Stripe | Payer email, operation/subscription identifier | Process the payment |
| DeepSeek / OpenAI | Your prompts and map context | Generate AI assistant responses |
| Google (Geocoding / Places) | Addresses you search or pick | Convert addresses to coordinates |
| Mapbox | Technical map load data | Render the map (editor and published) |
| Hetzner (Object Storage) | Images you upload | File storage |
Some providers are located outside Mexico. These international transfers/processing are necessary to provide the Service you request and are carried out under the exceptions provided by the LFPDPPP (among others, the one necessary to fulfill the legal relationship between you and us). Each provider has its own privacy policy. We do not sell your personal data.
5. Data retention
- We keep your data while your account is active and for as long as needed to meet legal, tax and security obligations.
- We use logical deletion (soft-delete): deleted content is marked as removed and kept for a period before final deletion.
- Retention periods: [TO DEFINE] for IP and activity logs; [TO DEFINE] for account data after cancellation, except applicable tax obligations.
6. ARCO rights and automated decisions
You have the right to Access, Rectify, Cancel or Object (ARCO) to the processing of your data, and to revoke your consent. Exercising these rights is free.
The LFPDPPP in force strengthens your right to object to automated processing when it produces effects that significantly affect you. In SpotLocator, the AI assistant performs automated processing limited to operating the editor under your instructions; you may choose not to use it or request information about how it works.
To exercise your rights, write to [correo de privacidad] stating your name, the associated account, the right you exercise and the data it concerns. We will respond within the legal timeframes.
7. Security
We apply measures such as password hashing (Argon2id), session tokens with expiration and device binding, encrypted connection (HTTPS) and per-account access control. No system is completely infallible, but we work to protect your information.
9. Authority
The authority for the protection of personal data held by private parties is the Ministry of Anticorruption and Good Governance (which assumed the functions of the former INAI following the 2025 reform). If you believe your right has been violated, you may turn to that authority.
10. Changes to this Notice
We may update this Notice. Under the law in force, any change to purposes requiring your consent will be requested again. We will notify you of relevant changes. The current version is always available in the platform.